Bug 2047343 (CVE-2022-21363)

Summary: CVE-2022-21363 mysql-connector-java: Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors
Product: [Other] Security Response Reporter: Guilherme de Almeida Suckevicz <gsuckevi>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aileenc, alazarot, anstephe, aos-bugs, asoldano, atangrin, avibelli, bbaranow, bbuckingham, bcourt, bgeorges, bibryam, bmaxwell, bmontgom, brian.stansberry, btotty, cdewolf, chazlett, clement.escoffier, dandread, darran.lofthouse, databases-maint, dkreling, dosoudil, drieden, ehelms, eleandro, emingora, eparis, etirelli, fjuma, gmalinko, gmorling, gsmet, hamadhan, hbraun, hhorak, ibek, iweiss, janstey, java-sig-commits, jburrell, jjanco, jnethert, jochrist, jokerman, jolee, jpallich, jpechane, jperkins, jrokos, jschatte, jsherril, jstastny, jwon, krathod, kverlaen, kwills, lgao, ljavorsk, lthon, lzap, mhulan, mkulik, mmccune, mmuzila, mnovotny, mschorm, msochure, msvehla, mszynkie, myarboro, nmoumoul, nstielau, nwallace, odubaj, orabin, pantinor, pcreech, pdelbell, peholase, pgallagh, pjindal, pmackay, probinso, puntogil, rchan, rguimara, rrajasek, rruss, rstancel, rsvoboda, sbiarozk, sd-operator-metering, sdouglas, smaestri, sponnaga, steve.traylen, tflannag, tom.jenkinson, tzimanyi, vkumar, xjakub, yborgess, zmiklank
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2022-06-06 19:21:39 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2047344, 2048912, 2054894    
Bug Blocks: 2047346    

Description Guilherme de Almeida Suckevicz 2022-01-27 16:37:21 UTC
Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).

Reference:
https://www.oracle.com/security-alerts/cpujan2022.html

Comment 1 Guilherme de Almeida Suckevicz 2022-01-27 16:37:55 UTC
Created mysql-connector-java tracking bugs for this issue:

Affects: fedora-all [bug 2047344]

Comment 11 errata-xmlrpc 2022-05-18 10:56:33 UTC
This issue has been addressed in the following products:

  Red Hat build of Quarkus 2.7.5

Via RHSA-2022:4623 https://access.redhat.com/errata/RHSA-2022:4623

Comment 12 errata-xmlrpc 2022-06-06 15:12:07 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform

Via RHSA-2022:4922 https://access.redhat.com/errata/RHSA-2022:4922

Comment 13 errata-xmlrpc 2022-06-06 15:52:20 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7

Via RHSA-2022:4918 https://access.redhat.com/errata/RHSA-2022:4918

Comment 14 errata-xmlrpc 2022-06-06 15:58:43 UTC
This issue has been addressed in the following products:

  Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8

Via RHSA-2022:4919 https://access.redhat.com/errata/RHSA-2022:4919

Comment 15 Product Security DevOps Team 2022-06-06 19:21:33 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-21363

Comment 16 errata-xmlrpc 2022-07-07 14:22:08 UTC
This issue has been addressed in the following products:

  Red Hat Fuse 7.11

Via RHSA-2022:5532 https://access.redhat.com/errata/RHSA-2022:5532

Comment 17 errata-xmlrpc 2022-10-05 10:45:21 UTC
This issue has been addressed in the following products:

  RHPAM 7.13.1 async

Via RHSA-2022:6813 https://access.redhat.com/errata/RHSA-2022:6813